Patent Application
20120110184
The disclosure relates to a physical layer photonic protocol switch (PLPPS) that is protocol independent and switches at the optical signal level.
A physical network is a system of devices or resources that communicate via cabling, modems, routers, or other hardware. The resources are physically connected to a computing infrastructure to form a logical system topology and are managed independently of any other logical system topology with a distinct separation of responsibilities, different security levels and different rules in each topology. Each logical system topology is seen as a private area where information is not openly shared with other topologies and is isolated from other topologies. Each logical system topology can be seen as having its own security classification that may be different than the security classification of any other logical system topology. In order to share or reassign computing subsystem resources between logical system topologies, the subsystem resources must be manually unplugged from a network switch of a first logical system topology and then manually plugged into a network switch of a second logical system topology.
In a typical scenario of secure interconnect capability, as shown in
As illustrated in
Therefore, without manual reconfiguration and sanitization of the equipment, the mission system equipment or subsystem resources cannot be shared between multiple security classification levels. For example, if users of two separate security classifications require the use of a processor, then two separate processors would normally need to be provided.
is A physical layer photonic protocol switch (PLPPS) that is protocol independent and switches at the optical signal level is described herein. Computing subsystem resources are connected to the PLPPS and are able to be allocated or shared with one or more logical system topologies (LST) or enclaves of differing security levels. Embedded within the PLPPS is a configuration policy manager and controller having a topology policy library that contains the approved or accredited list of logical system topologies permitted access to the system. During runtime additional computing subsystem resources can be allocated to a specific logical system topology or shared amongst a plurality of logical system topologies, when needed.
The PLPPS provides the ability to dynamically allocate computing subsystem resources to specific computing enclaves or logical system topologies without the need to manually reconfigure the connection to the PLPPS. The PLPPS manages the configuration of and controls access to the computing subsystem resources. Computing subsystem resources can then be assigned to specific logical system topologies and additional computing subsystem resources are able to be shared, added or removed, from other logical system topologies, as needs fluctuate. This physical layer switch architecture creates a dynamic computing infrastructure allowing for the sharing of a single computing subsystem resource amongst two or more logical system topologies of differing security classification levels while performing high-speed data manipulation, all while maintaining channel separation and security separation.
The PLPPS is a dynamic computing system that is advantageous in that allocation of computing subsystem resources is done without the physical or manual manipulation of the computing subsystem resources. This architecture driven allocation is less time consuming than the physical act of unplugging and plugging in a computing subsystem resource or a user inputting data. Another advantage is that more processes are able to be run with fewer separate subsystem resources. Additionally, the space or footprint required to house the various subsystem resources is reduced. The reduced footprint also is helpful in supporting multiple missions from limited space environments.
The PLPPS can also provide a secure computing environment where the separation of data between different security classifications is essential. In a military environment, this allows for the sharing of mission system equipment across multiple security sensitivity levels and enables a reduction in size, weight and power (SWaP) of embedded mission system equipment applications. Different security enclaves can be created without additional hardware resources and under-utilized subsystem resources can be reassigned to other security enclaves.
Applications of a PLPPS include public and private entities. Example applications of a PLPPS include, but are not limited to: space constrained systems, where subsystem resources need to be shared amongst several software applications; applications which require subsystem resources to be reconfigured or redistributed during the mission; distributed computing systems; and ad hoc computing systems. Users can comprise commercial or public enterprises, for example, businesses involved in processing of payroll, insurance companies, banks, accounting firms, private security, police and fire departments, Department of Defense, and the military. In essence, users of a dynamic computing system could comprise any entity that may require more than one user system, especially where the user systems are of different security levels.
One advantage of the dynamic nature of the PLPPS infrastructure allows for better subsystem resource sharing. In space constrained systems, such as a Navy surface ship or submarine, subsystem resources may need to be shared amongst several software applications during the mission, but the information contained within those subsystem resources is not to be shared. The PLPPS ensures that the information remains separated by providing both a strong port-to-port separation and an ability to securely block specific ports from receiving unauthorized information flows through the protocol switch.
An additional advantage of the PLPPS dynamic enclave computing system allows for switching at a physical layer of a network stack, which is protocol independent. Currently, most computing infrastructures in Department of Defense (DoD) platforms are fixed to the underlying local area network (LAN). Therefore, with the PLPPS, the potential is higher to get security certified for DoD platform applications than applications that require commercial-off-the-shelf (COTS) virtual local area networks (VLAN) or COTS VLAN.
A physical layer photonic protocol switch (PLPPS) system that is protocol independent and switches at the optical signal level is described herein. Computing subsystem resources are connected to the PLPPS and are able to be allocated or shared amongst one or more logical system topologies while maintaining the separation amongst channels and security levels. Embedded within the PLPPS is a configuration policy manager and controller having a topology library that contains the approved or accredited list of logical system topologies permitted access to the PLPPS and the security classification. If needed, additional computing subsystem resources can be allocated to the logical system topology, during runtime.
The PLPPS is configured to dynamically allocate computing subsystem resources to specific computing enclaves or logical system topologies. The PLPPS is configured to manage the configuration of and control access to the computing subsystem resources. Computing subsystem resources can then be assigned to specific logical system topologies and additional computing subsystem resources are able to be shared, added or removed, from other logical system topologies, as needs fluctuate. The physical layer switch architecture of the PLPPS creates a dynamic computing infrastructure further allowing for the sharing of a single computing subsystem resource amongst two or more logical system topologies while performing high-speed data manipulation. The physical layer switch architecture separates the different channels and allows some channels to flow while blocking others.
This application refers to a computing system and is intended to broadly cover the class of hardware architectures and software used for computing. Computing can mean the activity of using computer technology, whether it is computer hardware and/or software. For example, the computing system can comprise some form of network, regardless of whether that network is printed onto a circuit board or made up of linked devices and cables. And the computing system processes are able to be interconnected via some form of communication system, comprising equipment or cabling. However, this application is also intended to encompass computer hardware architecture and software that does not perform mathematical and logical operations.
Computing is also intended to encompass activities requiring or benefiting from computers. Thus, computing encompasses hardware and software systems for the purposes of, for example, processing, structuring, and managing various kinds of information, doing scientific studies using computers, making computer systems behave intelligently, creating and using communications and entertainment media, finding and gathering information relevant to any particular purpose, capturing data from sensors, e.g. an ethernet enable camera, and so on.
With reference to
The PLPPS system 10 is based on a conventional optical wavelength division multiplexing (WDM) star/coupler architecture. Thus, for networks that support multi-enclave information, the PLPPS system 10 implementation provides a secure network that protects each logical system topology 20 by providing a strong port-to-port separation and an ability to securely block specific ports from receiving unauthorized information flows. The PLPPS system 10 creates a plane of trust 52 (see
It is to be understood that even though the PLPPS 12 is described herein as being optical based, it is possible that a non-optical system or electronic patch panel can be used that could perform high-speed data manipulation and assign and share subsystem resources 18 as described herein.
The PLPPS system 10 differs from current optical switches on the market, e.g. micro-electro-mechanical systems (MEMS), as illustrated in
One embodiment of the a PLPPS system 10 is shown in more detail in
The CPMC 14 is connected to the optical blockers 42 (the connection is not shown in
The CPMC 14 is a computing device that manages the policies of the logical system topologies 20 and controls and manages the functional elements of the PLPPS 12. The CPMC 14 manages the configuration of the optical signal and gives permissions to allow certain wavelengths while blocking other wavelengths. The CPMC 14 is responsible for managing and controlling the optical blocker 42, thereby effectively controlling and managing the configuration of the subsystem resources 18. As shown in
The topology policy library 22 is an information library based on data structures that have been loaded. The data structures contain the approved or accredited collection of logical system topologies 20 that the PLPPS 12 can support and the logical system topologies 20 that are permitted to access the PLPPS 12 and access and use the subsystem resources 18. The topology policy library 22 determines the connectivity, through the optical blocker 42, between the various subsystem resources 18 and the PLPPS 12 by providing information to the optical blocker 42 on which optical wavelengths or signals to allow or block. This is accomplished while maintaining the proper security classification levels, maintaining the plane of trust 52 and preventing the cross-over of information between the logical system topologies 20 of differing security classification levels. The topology policy library 22 can only be accessed and modified by users with the proper credentials and password access, but can be modified while in use, if needed.
The failover control module 24 controls the reconfiguration of the system in the event of a system failure. The diagnostics module 26 performs the power up and runtime Built-In-Test. The external management and control interface module 28 can be browser based. The interface module 28 can be an external interface consisting of COTS protocol, e.g. a port and an Ethernet switch. The audit module 30 collects and records all security critical events.
Allowance or blockage of the various wavelengths is accomplished through the control modules for the internal optics transmit and receive functions 32, 34, which is in essence an optical filter which separates the different channels.
The CPMC 14 is linked to the optical blocker 42 via a wired connection or a wireless connection. The wired connection may include, for example, fiber optic, coaxial, or twisted pair structured cabling. The wireless connection may include, for example, infrared radiation, microwave, or radio waves through a medium like air and may include, for example, narrowband, broadband, or circuit/packet data. However, any type of connection to link the optical blocker 42 and the CPMC 14 so that they can communicate can be used.
One or more protocol processors 16 are provided. The protocol processor 16 is an electronic device that makes it possible to interconnect the various subsystem resources 18 to specific transmission paths based on input from the CPMC 14. The protocol processor 16 provides Layer 2 and higher Protocol switch and protocol functions including MAC protocol, discovery protocol, packet switching/routing, etc. The protocol processor 16 adds an abstraction layer between the cable plant and the computing resources and provides the electrical interface to the optical transmitters 44 and receivers 46.
One or more ports 40 are provided on the PLPPS 12. The ports 40 allow the computing subsystem resources 18 to connect to the PLPPS 12 in order to transmit and receive data to and from the PLPPS 12. The port 40 can be a wired or a wireless connection. The wireless connection can be radio frequency, infrared light, laser light, visible light, acoustic energy or any other means available to transfer information without the use of wires. The wired connection can include RS-232, USB, Category 5 Ethernet cable, or any other type of connection that physically connects the computing subsystem resources 18 to the PLPPS 12 and is able to transmit information.
One or more optical blockers 42 are provided. The optical blockers 42 implement the logical system topology 20 configuration policy by configuring which wavelengths to allow and which wavelengths to block. The optical blocker 42 is protocol independent and does not inspect incoming traffic or make routing decisions. The optical blocker 42 is controlled by and instructed by the CPMC 14 as to which wavelengths are to be transmitted and which wavelengths are to be blocked.
One or more optical transmitters 44 and receivers 46 are provided. A optical transmitter 44 and receiver 46 uses fiber optic technology to efficiently send and receive data, respectively, audio, and video at high speed data rates over with minimal signal skew. Transmitters 44 convert electrical signals into optical signals and receivers 46 convert optical signals into electrical signals.
One or more optical filters 48 are provided. Optical filters 48 are designed to pass specific wavelengths and reject others. The optical filters 48 can be either low-pass or high-pass filters but are most likely band-pass filters. A low-pass fiber optic filter allows only shorter wavelengths of light to pass through the filter 48, while a high-pass fiber optic filter allows only the longer wavelengths to pass through. A band-pass optical filter allows only a narrow range of wavelengths to pass through. Fiber optics filters 48 can be fine-tuned to select very narrow wavelength ranges.
One or more demultiplexers 50 are provided. A demultiplexer 50 receives multiple signals that have been transmitted on one line and then decodes these single line signals into separate multiple signals. The demultiplexer 50 is able to transmit the individual data signals from multiple logical system topologies 20 simultaneously over one communications medium while maintaining separation and security of the data. The demultiplexer 50 supports the implementation of the logical system topology 20 configuration policy by separating the different channels for the optical blockers 42.
The passive optical star (POS) 52 is a passive platform for implementing the optical network by providing broadcast capability. Through Wavelength Division Multiplexing (WDM), a large bandwidth of optical fiber can be divided into a set of high-speed logical channels. One wavelength can be provided to the POS 52 and multiple wavelengths can be distributed. All WDM wavelengths are combined on the POS 52.
The computing subsystem resources 18 comprise any component that can be attached to a computing network including, but not limited to, processors, external communication devices, internal communication devices, storage devices, down graders, sensors, displays, network switches, guards, printers, servers, scanners, voice over IP systems, workstations, personal computers, etc. The subsystem resources 18 are linked to the PLPPS 12 via a wired connection or a wireless connection via a port 40. The wired connection may include, for example, fiber optic, coaxial, or twisted pair structured cabling. The wireless connection may include, for example, infrared radiation, microwave, or radio waves through a medium like air and may include, for example, narrowband, broadband, or circuit/packet data. However, any type of connection to link the PLPPS 12 and the subsystem resources 18 so that they can communicate can be used.
For example, one type of subsystem resource 18 can be a processor. A processor is an electronic circuit that can execute computer programs and are made for one or many purposes. This includes, but is not limited to, central processing units (CPU) and microprocessors. There can be any number or no processors in the PLPPS system 10.
Another type of subsystem resource 18 can be a storage device. A storage device is any device for recording or storing information or data. A storage device may hold information, process information, or both. Storage devices include, but are not limited to, random access memory (RAM), optical disks, floppy disks, USB flash drives, hard disk drives, magnetic tape, film, punch cards, and video tapes. There can be any number or no storage devices in the PLPPS system 10.
Another type of subsystem resource 18 can be a communication device. A communication device can be on- or off-platform or external/internal. The communication device can be, for example, wide-band, satellite communications, radio communications, or a terminal. There can be any number or no communication devices in the PLPPS system 10.
Another type of subsystem resource 18 can be a sensor. The sensor can be, but is not limited to, a camera, surveillance radar, electronic support measures (ESM), identify friend or foe (IFF) or automatic identification system (AIS). There can be any number or no sensors in the PLPPS system 10.
Each type of subsystem resource 18 could be comprised of a plurality of that type of resource or a combination of any type of subsystem resource 18. However, each type of subsystem resource 18 could be none or any number of subsystem resources 18.
A logical system topology 20 may be isolated, maintained separate, or private, from other logical system topologies 20 and may be allocated to perform specific processing activities or be allocated to specific computing groups. For example, one logical system topology 20 can be a surveillance data distribution topology while a separate topology can be a communications relay.
A logical system topology's 20 information may be kept private and not shared with other logical system topologies 20. Another example may allow for sharing of information, in whole or in part, between logical system topologies 20. Additionally, a logical system topology 20 may be configured as a subsystem resource 18 and allocated to a separate logical system topology 20.
The logical system topologies 20 data is downloaded or transferred to the CPMC 14 topology library 22. The transfer of data can be accomplished by a wired connection, a wireless connection, via a data storage device, e.g., a thumb drive, hard drive, magnetic tape, optical disk, or by any known or yet to be known method of data transfer. The wired connection may include, for example, fiber optic, coaxial, or twisted pair structured cabling. The wireless connection may include, for example, infrared radiation, microwave, or radio waves through a medium like air and may include, for example, narrowband, broadband, or circuit/packet data.
In the PLPPS system 10, a logical system topology 20 can acquire additional resources 18. The CPMC 14 sends messages using application software to instruct the optical blocker 42 to allocate subsystem resources 18 to specific logical system topologies 20. The CPMC 14 has knowledge, by function modules, of all subsystem resources 18, where each subsystem resource 18 is allocated and whether the subsystem resource 18 is in use or is available or can be shared. The CPMC 14 is able to allocate the subsystem resources 18 to specific logical system topologies 20 and is able to add or reduce subsystem resources 18 to the logical system topologies 20 as needed by instructing the optical blocker 42 to configure wavelengths to allow or block specific channels.
An example of how a subsystem resource 18 is assigned to a specific logical system topology 20 in the PLPPS system 10 follows and is illustrated in
Shown in
The second logical system topology 20 is a communications relay capability within theater topology 20b used in a military setting in which the theater 224 comprises any number of military radios 228. The theater 224 is in communication with an Unmanned Aerial System (UAS) Infrastructure Topology 230 where the UAS Infrastructure Topololgy 230 consists of an Ethernet switch 234, a down grader 236, and any number of military radios 228.
The logical system topology 20, for example, the surveillance data distribution topology 20a, is in contact with the PLPPS system 10 via the topology library 22. As the logical system topology 20a collects and processes data, it is realized by the topology 20a that additional processing capability is required. A request is sent from the logical system topology 20a to the CPMC 14 requesting a processor 202. The CPMC 14 receives the request and determines, per its approved list as to whether the specific logical system topology 20a is permitted access to the system and a processor 202.
Upon verification of accessibility, the optical blocker 42 is instructed by the CPMC 14 to the unblock state to allocate a processor 202 to the requesting logical system topology 20a. A network path is then established so that the logical system topology 20a has access to the processor 202. Upon completion of the task, when the logical system topology 20a no longer has a need for the additional processing capability, the CPMC 14 closes the optical blocker 42 and the processor 202 is no longer available to the logical system topology 20a but is available to and can be reassigned to other logical system topologies 20 as needed. The allocation of the subsystem resources 18 are platform and mission dependent so that in some operations the subsystem resources 18 will require sanitization and in other operations no sanitization is required. For example, if the processor 202 is provided to a logical system topology 20 up in security level from its previous assignment, no sanitization may be necessary. But, if the processor 202 is provided to a logical system topology 20 down in security level, sanitization may be necessary.
The examples disclosed in this application are to be considered in all respects as illustrative and not limitative. The scope of the invention is indicated by the appended claims rather than by the foregoing description; and all changes which come within the meaning and range of equivalency of the claims are intended to be embraced therein.
